لطفا منتظر باشید ...
Recipe 2.22 Building Complex Rule Trees
2.22.1 Problem
You want to construct
complex firewall behaviors, but you are getting lost in the
complexity.
2.22.2 Solution
Be modular: isolate behaviors into their own chains. Then connect the
chains in the desired manner.For
iptables:
# iptables -N CHAIN1
# iptables -N CHAIN2
# iptables -N CHAIN3
# iptables -N CHAIN4
# iptables -N CHAIN5
Add your rules to each chain. Then connect the chains; for example:
# iptables -A INPUT ...specification... -j CHAIN1
# iptables -A CHAIN1 ...specification... -j CHAIN2
# iptables -A CHAIN2 ...specification... -j CHAIN3
# iptables -A INPUT ...specification... -j CHAIN4
# iptables -A INPUT ...specification... -j CHAIN5
to create a rule structure as in Figure 2-1.
Figure 2-1. Building rule chain structures in iptables or ipchains
For
ipchains:
# ipchains -N chain1
# ipchains -N chain2
# ipchains -N chain3
# ipchains -N chain4
# ipchains -N chain5
Add your rules to each chain. Then connect the chains, for example:
# ipchains -A input ...specification... -j chain1
# ipchains -A chain1 ...specification... -j chain2
# ipchains -A chain2 ...specification... -j chain3
# ipchains -A input ...specification... -j chain4
# ipchains -A input ...specification... -j chain5
to create the same rule structure as in Figure 2-1.
2.22.3 Discussion
Connecting chains is like modular programming with subroutines. The
rule:
# iptables -A CHAIN1 ...specification... -j CHAIN2
creates a jump point to CHAIN2 from this rule in CHAIN1, if the rule
is satisfied. Once CHAIN2 has been traversed, control returns to the
next rule in CHAIN1, similar to returning from a subroutine.
2.22.4 See Also
iptables(8), ipchains(8).
